---
title: "Download Channel Code"
method: GET
path: "/apps/{app_id}/channels/{channel_id}/code/download"
---

# Download Channel Code

`GET /apps/{app_id}/channels/{channel_id}/code/download`

## Request

- Base URL: `https://api.xhostd.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.xhostd.com/apps/{app_id}/channels/{channel_id}/code/download`
- Auth: none declared

Stream a ``tar`` of one checkpoint's code.

``snapshot_id`` names a Postgres snapshot of this channel, and the
route streams the sha that row recorded. Without it the route streams
the channel's ``current_sha``, which is what an export holds today.
The parameter is deliberately not an arbitrary ``ref``: this route
serves checkpoints, and ``GET /apps/{app_id}/tree`` already serves an
arbitrary ref.

The channel load runs FIRST, so a stranger reads 404. The flag
follows it. A row with no recorded sha answers 404
``snapshot_sha_unknown``, and so does a channel that never deployed.
A sha the cell cannot resolve answers 404 ``snapshot_code_gone``: the
cell's pin ref protects the current sha alone, so a force-push plus a
later ``git gc`` can remove an old checkpoint's commit. Both 404s are
permanent, and a client must not repeat the call.

## Path parameters

- `app_id` string, uuid, required
- `channel_id` string, uuid, required

## Query parameters

- `snapshot_id` string, uuid, nullable

## Headers

- `authorization` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/xhostd/apis/xhostd-public.md) · [All operations](https://skmtc.dev/xhostd/apis/xhostd-public/llms.txt) · [OpenAPI document](https://skmtc.dev/xhostd/apis/xhostd-public/revisions/bf439c4d1789?raw)